Which control type BEST describes a quarterly user access review that compares active accounts in a financial application against current human resources records?
- APreventive control, because the review stops unauthorised users from obtaining access to the financial application in the first place.
- BCorrective control, because the review automatically rolls back any incorrect permissions found in the financial application during the review.
- CCompensating control, because the review substitutes for the absence of a primary segregation of duties control inside the financial application.
- DDetective control, because the review identifies access that no longer aligns with current employment after it has been granted. Correct
Why A is wrong: A preventive control would block inappropriate access before it occurs, but a periodic review takes place after provisioning, so this classification reflects a common confusion about control timing.
Why B is wrong: Corrective controls remediate after detection, and the review itself does not perform the rollback; it produces findings that then drive corrective action, so this confuses detection with the follow-up remediation step.
Why C is wrong: A compensating control substitutes for a missing primary control by management decision, whereas a routine access review is a standalone monitoring activity rather than a substitute, making this a plausible but incorrect classification.
Why D is correct: User access reviews are after-the-fact comparisons that surface dormant, terminated or transferred user accounts that already exist, which is the defining characteristic of a detective control.